diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1fa93ae..6e42f5f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
           distribution: temurin
           java-version: ${{ matrix.java }}
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       - name: Build + test all modules (test tasks finalize with Jacoco)
         run: ./gradlew --no-daemon build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4c35ca1..0463178 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,7 +29,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       - uses: github/codeql-action/init@v4
         with:
@@ -43,7 +43,7 @@ jobs:
         # the tracer sees zero compilations and the analyze step fails
         # with "could not process any code written in Java/Kotlin".
         # `clean` forces a recompile every run; `--no-build-cache`
-        # belt-and-braces against the gradle/actions/setup-gradle@v6
+        # belt-and-braces against the gradle/actions/setup-gradle@v6.2.0
         # build-cache restore.
         run: ./gradlew --no-daemon --no-build-cache clean classes
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4a52876..e5abb7e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -36,7 +36,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       - name: Verify tag matches build.gradle.kts version
         run: |